Pod security admission controller in Kubernetes - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the Pod Security Admission Controller in Kubernetes?

It is a built-in Kubernetes feature that checks pods against security policies before they are allowed to run, helping to enforce security standards.

beginner

Name the three Pod Security Admission Controller policy levels.

The three levels are: Privileged, Baseline, and Restricted. Each level defines different security restrictions for pods.

intermediate

How does the Pod Security Admission Controller enforce policies?

It intercepts pod creation or update requests and checks if the pod's security settings meet the policy. If not, it rejects the request.

intermediate

What is the difference between the Baseline and Restricted policy levels?

Baseline allows common, less risky permissions for pods, while Restricted enforces stricter rules to minimize security risks.

advanced

How can you enable the Pod Security Admission Controller in a Kubernetes cluster?

You enable it by configuring the API server with the --enable-admission-plugins flag including PodSecurity, and setting namespace labels to specify the policy level.

Which Kubernetes feature checks pod security settings before allowing them to run?

A Pod Scheduler

B Network Policy

C ConfigMap

D Pod Security Admission Controller

The Pod Security Admission Controller validates pod security settings before admission.

What are the three policy levels of Pod Security Admission Controller?

A Privileged, Baseline, Restricted

B Open, Closed, Custom

C Admin, User, Guest

D Low, Medium, High

The three levels are Privileged, Baseline, and Restricted.

Which policy level allows the most permissions to pods?

A Privileged

B Baseline

C Restricted

D None

Privileged policy allows the most permissions.

How does the Pod Security Admission Controller reject a pod?

A By deleting the pod after creation

B By restarting the pod automatically

C By blocking the pod creation request if it violates policy

D By sending an alert but allowing the pod

It blocks pod creation requests that do not meet security policies.

How do you specify which Pod Security policy applies to a namespace?

A By editing the pod spec

B By setting labels on the namespace

C By configuring the kubelet

D By changing the node configuration

Namespace labels define which Pod Security policy level applies.

Explain how the Pod Security Admission Controller helps improve Kubernetes cluster security.

Think about how it acts like a security guard for pods.

Describe the differences between the Privileged, Baseline, and Restricted Pod Security policies.

Compare the level of permissions allowed by each policy.